Not sure how widespread their "leakage" may be, but Dreamhost just hijacked one of my prefixes...
==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 150.182.192.0/18: Update time: 2013-01-11 14:14 (UTC) Detected by #peers: 11 Detected prefix: 150.182.208.0/20 Announced by: AS26347 (DREAMHOST-AS - New Dream Network, LLC) Upstream AS: AS42861 (PRIME-LINE-AS JSC "Prime-Line") ASpath: 8331 42861 42861 42861 26347
Anyone have a contact there? ASinfo gives netops@dreamhost.com where I have submitted a report, but so far no joy... Jeff
Jeff, We are not announcing the prefix in question nor do we peer with AS42861. -- Best Regards, Kenneth McRae *Director, Network Operations* kenneth.mcrae@dreamhost.com Ph: 818-447-2589 www.dreamhost.com On Fri, Jan 11, 2013 at 7:23 AM, Jeff Kell <jeff-kell@utc.edu> wrote:
Not sure how widespread their "leakage" may be, but Dreamhost just hijacked one of my prefixes...
==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 150.182.192.0/18: Update time: 2013-01-11 14:14 (UTC) Detected by #peers: 11 Detected prefix: 150.182.208.0/20 Announced by: AS26347 (DREAMHOST-AS - New Dream Network, LLC) Upstream AS: AS42861 (PRIME-LINE-AS JSC "Prime-Line") ASpath: 8331 42861 42861 42861 26347
Anyone have a contact there? ASinfo gives netops@dreamhost.com where I have submitted a report, but so far no joy...
Jeff
-- Best Regards, Kenneth McRae *Sr. Network Engineer* kenneth.mcrae@dreamhost.com Ph: 323-375-3814 www.dreamhost.com
Robtex would beg to differ... you show peered with AS42861, perhaps someone (else) is looping their advertisements? _R_egistered _O_ther side _B_GP visible Peer OB AS174 COGENT /PSI B AS4323 TWTC Autonomous system for tw telecom . B AS4826 VOCUS-BACKBONE-AS Vocus Connect International Backbone Vocus Communications Level 2, Vocus House 189 Miller Street North Sydney NSW 2060 B AS5580 ATRATO-IP / Atrato IP Networks B AS6461 MFNX MFN - Metromedia Fiber Network B AS6939 HURRICANE Electric B AS7575 AARNET-AS-AP Australia's Research and Education Network (AARNet3) B AS7922 COMCAST-IBONE Comcast Cable Communications, Inc. 1800 Bishops Gate Blvd Mt Laurel, NJ 08054 US B AS8359 MTS Dummy description for B AS10912 INTERNAP-BLK Internap Network Services B AS10913 INTERNAP-BLK Internap Network Services B AS12989 HWNG Eweka Internet Services B.V. B AS36351 SOFTLAYER Technologies Inc. B AS42861 PRIME-LINE-AS Dummy description for On 1/11/2013 10:42 AM, Kenneth McRae wrote:
Jeff,
We are not announcing the prefix in question nor do we peer with AS42861.
-- Best Regards,
Kenneth McRae *Director, Network Operations* kenneth.mcrae@dreamhost.com Ph: 818-447-2589 www.dreamhost.com
On Fri, Jan 11, 2013 at 7:23 AM, Jeff Kell <jeff-kell@utc.edu> wrote:
Not sure how widespread their "leakage" may be, but Dreamhost just hijacked one of my prefixes...
> ==================================================================== > Possible Prefix Hijack (Code: 10) > ==================================================================== > Your prefix: 150.182.192.0/18: > Update time: 2013-01-11 14:14 (UTC) > Detected by #peers: 11 > Detected prefix: 150.182.208.0/20 > Announced by: AS26347 (DREAMHOST-AS - New Dream Network, LLC) > Upstream AS: AS42861 (PRIME-LINE-AS JSC "Prime-Line") > ASpath: 8331 42861 42861 42861 26347
Anyone have a contact there? ASinfo gives netops@dreamhost.com where I have submitted a report, but so far no joy...
Jeff
-- Best Regards,
Kenneth McRae *Sr. Network Engineer* kenneth.mcrae@dreamhost.com Ph: 323-375-3814 www.dreamhost.com
Just checked all BGP speakers again and I show no peering with AS42861. On Fri, Jan 11, 2013 at 7:49 AM, Jeff Kell <jeff-kell@utc.edu> wrote:
Robtex would beg to differ... you show peered with AS42861, perhaps someone (else) is looping their advertisements?
*R*egistered *O*ther side *B*GP visible Peer OB AS174 COGENT /PSI B AS4323 TWTC Autonomous system for tw telecom . B AS4826 VOCUS-BACKBONE-AS Vocus Connect International Backbone Vocus Communications Level 2, Vocus House 189 Miller Street North Sydney NSW 2060 B AS5580 ATRATO-IP / Atrato IP Networks B AS6461 MFNX MFN - Metromedia Fiber Network B AS6939 HURRICANE Electric B AS7575 AARNET-AS-AP Australia's Research and Education Network (AARNet3) B AS7922 COMCAST-IBONE Comcast Cable Communications, Inc. 1800 Bishops Gate Blvd Mt Laurel, NJ 08054 US B AS8359 MTS Dummy description for B AS10912 INTERNAP-BLK Internap Network Services B AS10913 INTERNAP-BLK Internap Network Services B AS12989 HWNG Eweka Internet Services B.V. B AS36351 SOFTLAYER Technologies Inc. B AS42861 PRIME-LINE-AS Dummy description for
On 1/11/2013 10:42 AM, Kenneth McRae wrote:
Jeff,
We are not announcing the prefix in question nor do we peer with AS42861.
-- Best Regards,
Kenneth McRae *Director, Network Operations* kenneth.mcrae@dreamhost.com Ph: 818-447-2589 www.dreamhost.com
On Fri, Jan 11, 2013 at 7:23 AM, Jeff Kell <jeff-kell@utc.edu><jeff-kell@utc.edu>wrote:
Not sure how widespread their "leakage" may be, but Dreamhost just hijacked one of my prefixes...
==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 150.182.192.0/18: Update time: 2013-01-11 14:14 (UTC) Detected by #peers: 11 Detected prefix: 150.182.208.0/20 Announced by: AS26347 (DREAMHOST-AS - New Dream Network, LLC) Upstream AS: AS42861 (PRIME-LINE-AS JSC "Prime-Line") ASpath: 8331 42861 42861 42861 26347
Anyone have a contact there? ASinfo gives netops@dreamhost.com where I have submitted a report, but so far no joy...
Jeff
-- Best Regards,
Kenneth McRae *Sr. Network Engineer* kenneth.mcrae@dreamhost.com Ph: 323-375-3814 www.dreamhost.com
-- Best Regards, Kenneth McRae *Sr. Network Engineer* kenneth.mcrae@dreamhost.com Ph: 323-375-3814 www.dreamhost.com
Here at/as AS5580 I no longer see it announced as a /20, only your own /18: #sh ip bgp routes 150.182.192.0 255.255.192.0 longer-prefixes Number of BGP Routes matching display condition : 4 Searching for matching routes, use ^C to quit... Status A:AGGREGATE B:BEST b:NOT-INSTALLED-BEST C:CONFED_EBGP D:DAMPED E:EBGP H:HISTORY I:IBGP L:LOCAL M:MULTIPATH m:NOT-INSTALLED-MULTIPATH S:SUPPRESSED F:FILTERED s:STALE Prefix Next Hop MED LocPrf Weight Status 1 150.182.192.0/18 80.94.64.10 400 0 BMI AS_PATH: 11164 10490 3450 14209 2 150.182.192.0/18 80.94.64.10 400 0 MI AS_PATH: 11164 10490 3450 14209 3 150.182.192.0/18 80.94.64.10 400 0 MI AS_PATH: 11164 10490 3450 14209 4 150.182.192.0/18 80.94.64.10 400 0 MI AS_PATH: 11164 10490 3450 14209 On 1/11/13 4:49 PM, Jeff Kell wrote:
Robtex would beg to differ... you show peered with AS42861, perhaps someone (else) is looping their advertisements?
_R_egistered _O_ther side _B_GP visible Peer OB AS174 COGENT /PSI B AS4323 TWTC Autonomous system for tw telecom . B AS4826 VOCUS-BACKBONE-AS Vocus Connect International Backbone Vocus Communications Level 2, Vocus House 189 Miller Street North Sydney NSW 2060 B AS5580 ATRATO-IP / Atrato IP Networks B AS6461 MFNX MFN - Metromedia Fiber Network B AS6939 HURRICANE Electric B AS7575 AARNET-AS-AP Australia's Research and Education Network (AARNet3) B AS7922 COMCAST-IBONE Comcast Cable Communications, Inc. 1800 Bishops Gate Blvd Mt Laurel, NJ 08054 US B AS8359 MTS Dummy description for B AS10912 INTERNAP-BLK Internap Network Services B AS10913 INTERNAP-BLK Internap Network Services B AS12989 HWNG Eweka Internet Services B.V. B AS36351 SOFTLAYER Technologies Inc. B AS42861 PRIME-LINE-AS Dummy description for
On 1/11/2013 10:42 AM, Kenneth McRae wrote:
Jeff,
We are not announcing the prefix in question nor do we peer with AS42861.
-- Best Regards,
Kenneth McRae *Director, Network Operations* kenneth.mcrae@dreamhost.com Ph: 818-447-2589 www.dreamhost.com
On Fri, Jan 11, 2013 at 7:23 AM, Jeff Kell <jeff-kell@utc.edu> wrote:
Not sure how widespread their "leakage" may be, but Dreamhost just hijacked one of my prefixes...
> ==================================================================== > Possible Prefix Hijack (Code: 10) > ==================================================================== > Your prefix: 150.182.192.0/18: > Update time: 2013-01-11 14:14 (UTC) > Detected by #peers: 11 > Detected prefix: 150.182.208.0/20 > Announced by: AS26347 (DREAMHOST-AS - New Dream Network, LLC) > Upstream AS: AS42861 (PRIME-LINE-AS JSC "Prime-Line") > ASpath: 8331 42861 42861 42861 26347
Anyone have a contact there? ASinfo gives netops@dreamhost.com where I have submitted a report, but so far no joy...
Jeff
-- Best Regards,
Kenneth McRae *Sr. Network Engineer* kenneth.mcrae@dreamhost.com Ph: 323-375-3814 www.dreamhost.com
-- Jeroen Wunnink Network Engineer Atrato IP Networks jeroen.wunnink@atrato-ip.com Phone: +31 20 82 00 623
Sounds like someone in Russia is having some fun with as-path prepending and prefix hijacking. On Fri, 11 Jan 2013, Kenneth McRae wrote:
Jeff,
We are not announcing the prefix in question nor do we peer with AS42861.
-- Best Regards,
Kenneth McRae *Director, Network Operations* kenneth.mcrae@dreamhost.com Ph: 818-447-2589 www.dreamhost.com
On Fri, Jan 11, 2013 at 7:23 AM, Jeff Kell <jeff-kell@utc.edu> wrote:
Not sure how widespread their "leakage" may be, but Dreamhost just hijacked one of my prefixes...
==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 150.182.192.0/18: Update time: 2013-01-11 14:14 (UTC) Detected by #peers: 11 Detected prefix: 150.182.208.0/20 Announced by: AS26347 (DREAMHOST-AS - New Dream Network, LLC) Upstream AS: AS42861 (PRIME-LINE-AS JSC "Prime-Line") ASpath: 8331 42861 42861 42861 26347
Anyone have a contact there? ASinfo gives netops@dreamhost.com where I have submitted a report, but so far no joy...
Jeff
-- Best Regards,
Kenneth McRae *Sr. Network Engineer* kenneth.mcrae@dreamhost.com Ph: 323-375-3814 www.dreamhost.com
---------------------------------------------------------------------- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/pgp for PGP public key_________
That would be my guess. We have had some issues with this in the past with operators from China and Russia. On Fri, Jan 11, 2013 at 7:51 AM, Jon Lewis <jlewis@lewis.org> wrote:
Sounds like someone in Russia is having some fun with as-path prepending and prefix hijacking.
On Fri, 11 Jan 2013, Kenneth McRae wrote:
Jeff,
We are not announcing the prefix in question nor do we peer with AS42861.
-- Best Regards,
Kenneth McRae *Director, Network Operations* kenneth.mcrae@dreamhost.com Ph: 818-447-2589 www.dreamhost.com
On Fri, Jan 11, 2013 at 7:23 AM, Jeff Kell <jeff-kell@utc.edu> wrote:
Not sure how widespread their "leakage" may be, but Dreamhost just
hijacked one of my prefixes...
==============================**==============================**
======== Possible Prefix Hijack (Code: 10) ==============================**==============================** ======== Your prefix: 150.182.192.0/18: Update time: 2013-01-11 14:14 (UTC) Detected by #peers: 11 Detected prefix: 150.182.208.0/20 Announced by: AS26347 (DREAMHOST-AS - New Dream Network, LLC) Upstream AS: AS42861 (PRIME-LINE-AS JSC "Prime-Line") ASpath: 8331 42861 42861 42861 26347
Anyone have a contact there? ASinfo gives netops@dreamhost.com where I have submitted a report, but so far no joy...
Jeff
-- Best Regards,
Kenneth McRae *Sr. Network Engineer* kenneth.mcrae@dreamhost.com Ph: 323-375-3814 www.dreamhost.com
------------------------------**------------------------------**---------- Jon Lewis, MCP :) | I route Senior Network Engineer | therefore you are Atlantic Net | _________ http://www.lewis.org/~jlewis/**pgp<http://www.lewis.org/~jlewis/pgp>for PGP public key_________
-- Best Regards, Kenneth McRae *Director, Network Operations* kenneth.mcrae@dreamhost.com Ph: 818-447-2589 www.dreamhost.com
Hi, Here's a quick summary of what we saw at BGPMon.net. At 2013-01-11 14:14:13 we saw announcements (seemingly) originated by 26347, for prefixes normally announced by other ASn's (origin change / hijack). This seems to have affected 112 prefixes for 110 ASn's [1], including Rogers, Tata, Sprint, Ziggo, Verizon, KPN, Vodafone, CloudFlare, XS4ALL, AT&T, Bell Canada and many more. Most of these were new more specific(!) announcements. With regards to next-hop ASN's (peers). It seems this hijack was propagated via 12 unique (AS26347) peers [1] A quick look at the prefix that was mentioned by Jeff, 150.182.208.0/20 (more specific of 50.182.192.0/18) The first announcement for this prefix was seen at 2013-01-11 14:14:28 and withdrawn at 2013-01-11 15:20:57. It was detected by 42 unique peers. some example paths: 271 6939 26347 5580 26347| 37312 5713 6939 26347 1126 24785 12989 26347 [1] I've posted some details (Unique next-hop ASN's and affected origin ASN's), check if your AS was affected here: http://portal.bgpmon.net/data/hijack20130111.txt Cheers, Andree .-- My secret spy satellite informs me that at 2013-01-11 7:23 AM Jeff Kell wrote:
Not sure how widespread their "leakage" may be, but Dreamhost just hijacked one of my prefixes...
==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 150.182.192.0/18: Update time: 2013-01-11 14:14 (UTC) Detected by #peers: 11 Detected prefix: 150.182.208.0/20 Announced by: AS26347 (DREAMHOST-AS - New Dream Network, LLC) Upstream AS: AS42861 (PRIME-LINE-AS JSC "Prime-Line") ASpath: 8331 42861 42861 42861 26347
Anyone have a contact there? ASinfo gives netops@dreamhost.com where I have submitted a report, but so far no joy...
Jeff
Thanks for that info Andree. The only valid peer I see on the list would be HE. We do not peer with any of the others listed. Kenneth On Fri, Jan 11, 2013 at 8:46 AM, Andree Toonk <andree+nanog@toonk.nl> wrote:
Hi, Here's a quick summary of what we saw at BGPMon.net.
At 2013-01-11 14:14:13 we saw announcements (seemingly) originated by 26347, for prefixes normally announced by other ASn's (origin change / hijack).
This seems to have affected 112 prefixes for 110 ASn's [1], including Rogers, Tata, Sprint, Ziggo, Verizon, KPN, Vodafone, CloudFlare, XS4ALL, AT&T, Bell Canada and many more. Most of these were new more specific(!) announcements.
With regards to next-hop ASN's (peers). It seems this hijack was propagated via 12 unique (AS26347) peers [1]
A quick look at the prefix that was mentioned by Jeff, 150.182.208.0/20 (more specific of 50.182.192.0/18) The first announcement for this prefix was seen at 2013-01-11 14:14:28 and withdrawn at 2013-01-11 15:20:57. It was detected by 42 unique peers.
some example paths: 271 6939 26347 5580 26347| 37312 5713 6939 26347 1126 24785 12989 26347
[1] I've posted some details (Unique next-hop ASN's and affected origin ASN's), check if your AS was affected here: http://portal.bgpmon.net/data/hijack20130111.txt
Cheers, Andree
.-- My secret spy satellite informs me that at 2013-01-11 7:23 AM Jeff Kell wrote:
Not sure how widespread their "leakage" may be, but Dreamhost just hijacked one of my prefixes...
==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 150.182.192.0/18: Update time: 2013-01-11 14:14 (UTC) Detected by #peers: 11 Detected prefix: 150.182.208.0/20 Announced by: AS26347 (DREAMHOST-AS - New Dream Network, LLC) Upstream AS: AS42861 (PRIME-LINE-AS JSC "Prime-Line") ASpath: 8331 42861 42861 42861 26347
Anyone have a contact there? ASinfo gives netops@dreamhost.com where I have submitted a report, but so far no joy...
Jeff
Hi Kenneth, .-- My secret spy satellite informs me that at 2013-01-11 8:54 AM Kenneth McRae wrote:
Thanks for that info Andree. The only valid peer I see on the list would be HE. We do not peer with any of the others listed.
Could it be these ASns receive your routes via an IX route-server? Below some examples that show a peering between 26347 and 5580 as well as 12989 5580 26347 http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC031&query=12&arg=5580+26347 12989 26347: http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC031&query=12&arg=12989+26347 And route views: route-views>sh ip bgp regex 12989_26347 BGP table version is 427410275, local router ID is 128.223.51.103 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path * 64.111.96.0/19 208.74.64.40 0 19214 12989 26347 i * 66.33.192.0/19 208.74.64.40 0 19214 12989 26347 i * 67.205.0.0/18 208.74.64.40 0 19214 12989 26347 i * 69.163.128.0/17 208.74.64.40 0 19214 12989 26347 i * 75.119.192.0/19 208.74.64.40 0 19214 12989 26347 i * 173.236.128.0/17 208.74.64.40 0 19214 12989 26347 i * 205.196.208.0/20 208.74.64.40 0 19214 12989 26347 i * 208.97.128.0/18 208.74.64.40 0 19214 12989 26347 i * 208.113.128.0/17 208.74.64.40 0 19214 12989 26347 i * 208.113.200.0 208.74.64.40 0 19214 12989 26347 i Cheers, Andree
Hi all, Atrato / 5580 here. We don't have direct peering with AS26347, although we learn the AS26347 prefixes through the 206.223.143.253 (AS 19996) routeserver in LAX. So in a sense we are peering :-) Kind regards, Job On Jan 11, 2013, at 7:31 PM, Andree Toonk <andree+nanog@toonk.nl> wrote:
Hi Kenneth,
.-- My secret spy satellite informs me that at 2013-01-11 8:54 AM Kenneth McRae wrote:
Thanks for that info Andree. The only valid peer I see on the list would be HE. We do not peer with any of the others listed.
Could it be these ASns receive your routes via an IX route-server?
Below some examples that show a peering between 26347 and 5580 as well as 12989
5580 26347 http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC031&query=12&arg=5580+26347
12989 26347: http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC031&query=12&arg=12989+26347
And route views:
route-views>sh ip bgp regex 12989_26347 BGP table version is 427410275, local router ID is 128.223.51.103 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path * 64.111.96.0/19 208.74.64.40 0 19214 12989 26347 i * 66.33.192.0/19 208.74.64.40 0 19214 12989 26347 i * 67.205.0.0/18 208.74.64.40 0 19214 12989 26347 i * 69.163.128.0/17 208.74.64.40 0 19214 12989 26347 i * 75.119.192.0/19 208.74.64.40 0 19214 12989 26347 i * 173.236.128.0/17 208.74.64.40 0 19214 12989 26347 i * 205.196.208.0/20 208.74.64.40 0 19214 12989 26347 i * 208.97.128.0/18 208.74.64.40 0 19214 12989 26347 i * 208.113.128.0/17 208.74.64.40 0 19214 12989 26347 i * 208.113.200.0 208.74.64.40 0 19214 12989 26347 i
Cheers, Andree
-- AS5580 - Atrato IP Networks
Yes, now that is possible (just no direct peering). So that takes me back to my original statement about not announcing the 150.182.208.0/20 prefix to begin with. Kenneth On Fri, Jan 11, 2013 at 10:31 AM, Andree Toonk <andree+nanog@toonk.nl>wrote:
Hi Kenneth,
.-- My secret spy satellite informs me that at 2013-01-11 8:54 AM Kenneth McRae wrote:
Thanks for that info Andree. The only valid peer I see on the list would be HE. We do not peer with any of the others listed.
Could it be these ASns receive your routes via an IX route-server?
Below some examples that show a peering between 26347 and 5580 as well as 12989
5580 26347
http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC031&query=12&arg=5580+26347
12989 26347:
http://www.ris.ripe.net/cgi-bin/lg/index.cgi?rrc=RRC031&query=12&arg=12989+26347
And route views:
route-views>sh ip bgp regex 12989_26347 BGP table version is 427410275, local router ID is 128.223.51.103 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path * 64.111.96.0/19 208.74.64.40 0 19214 12989 26347 i * 66.33.192.0/19 208.74.64.40 0 19214 12989 26347 i * 67.205.0.0/18 208.74.64.40 0 19214 12989 26347 i * 69.163.128.0/17 208.74.64.40 0 19214 12989 26347 i * 75.119.192.0/19 208.74.64.40 0 19214 12989 26347 i * 173.236.128.0/17 208.74.64.40 0 19214 12989 26347 i * 205.196.208.0/20 208.74.64.40 0 19214 12989 26347 i * 208.97.128.0/18 208.74.64.40 0 19214 12989 26347 i * 208.113.128.0/17 208.74.64.40 0 19214 12989 26347 i * 208.113.200.0 208.74.64.40 0 19214 12989 26347 i
Cheers, Andree
.-- My secret spy satellite informs me that at 2013-01-11 10:44 AM Kenneth McRae wrote:
Yes, now that is possible (just no direct peering). So that takes me back to my original statement about not announcing the 150.182.208.0/20 <http://150.182.208.0/20> prefix to begin with.
Here's some more data showing an announcement for 150.182.208.0/20 originated by 26347 http://www.ris.ripe.net/mt/rissearch-result.html?aspref=150.182.208.0%2F20&preftype=EMATCH&rrc_id=1000&peer=ALL&startday=20130111&starthour=00&startmin=00&startsec=00&endday=20130111&endhour=19&endmin=16&endsec=26&outype=html&submit=Search&.submit=type I can send you more data if you need it. Just contact me off-list. Cheers, Andree
Jeff: 150.182.208.0/20 is not visible from AS702 in Germany. 150.182.192.0/18 path is 702 701 209 26827 14209 Tony On 11 January 2013 15:23, Jeff Kell <jeff-kell@utc.edu> wrote:
Not sure how widespread their "leakage" may be, but Dreamhost just hijacked one of my prefixes...
==================================================================== Possible Prefix Hijack (Code: 10) ==================================================================== Your prefix: 150.182.192.0/18: Update time: 2013-01-11 14:14 (UTC) Detected by #peers: 11 Detected prefix: 150.182.208.0/20 Announced by: AS26347 (DREAMHOST-AS - New Dream Network, LLC) Upstream AS: AS42861 (PRIME-LINE-AS JSC "Prime-Line") ASpath: 8331 42861 42861 42861 26347
Anyone have a contact there? ASinfo gives netops@dreamhost.com where I have submitted a report, but so far no joy...
Jeff
participants (7)
-
Andree Toonk -
Jeff Kell -
Jeroen Wunnink | Atrato IP Networks -
Job Snijders -
Jon Lewis -
Kenneth McRae -
Tony McCrory